2019-06-07 18:58:27

by Ilya Maximets

Subject: [PATCH bpf] xdp: check device pointer before clearing

We should not call 'ndo_bpf()' or 'dev_put()' with NULL argument.

Fixes: c9b47cc1fabc ("xsk: fix bug when trying to use both copy and zero-copy on one queue id")
Signed-off-by: Ilya Maximets <[email protected]>
---

I'm not sure if this fixes any real NULL pointer dereference, but code
is not consistent anyway and should be fixed.

net/xdp/xdp_umem.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 2b18223e7eb8..9c6de4f114f8 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -143,6 +143,9 @@ static void xdp_umem_clear_dev(struct xdp_umem *umem)
struct netdev_bpf bpf;
int err;

+ if (!umem->dev)
+ return;
+
if (umem->zc) {
bpf.command = XDP_SETUP_XSK_UMEM;
bpf.xsk.umem = NULL;
@@ -156,11 +159,9 @@ static void xdp_umem_clear_dev(struct xdp_umem *umem)
WARN(1, "failed to disable umem!\n");
}

- if (umem->dev) {
- rtnl_lock();
- xdp_clear_umem_at_qid(umem->dev, umem->queue_id);
- rtnl_unlock();
- }
+ rtnl_lock();
+ xdp_clear_umem_at_qid(umem->dev, umem->queue_id);
+ rtnl_unlock();

if (umem->zc) {
dev_put(umem->dev);
--
2.17.1

2019-06-10 21:05:15

by Jonathan Lemon

Subject: Re: [PATCH bpf] xdp: check device pointer before clearing

On 7 Jun 2019, at 10:27, Ilya Maximets wrote:

> We should not call 'ndo_bpf()' or 'dev_put()' with NULL argument.
>
> Fixes: c9b47cc1fabc ("xsk: fix bug when trying to use both copy and
> zero-copy on one queue id")
> Signed-off-by: Ilya Maximets <[email protected]>
Acked-by: Jonathan Lemon <[email protected]>

2019-06-12 18:03:43

by Daniel Borkmann

Subject: Re: [PATCH bpf] xdp: check device pointer before clearing

On 06/07/2019 07:27 PM, Ilya Maximets wrote:
> We should not call 'ndo_bpf()' or 'dev_put()' with NULL argument.
>
> Fixes: c9b47cc1fabc ("xsk: fix bug when trying to use both copy and zero-copy on one queue id")
> Signed-off-by: Ilya Maximets <[email protected]>

Applied, thanks!